Commit ca3af4dd authored by Xin Long's avatar Xin Long Committed by David S. Miller
Browse files

sctp: do not free asoc when it is already dead in sctp_sendmsg 



Now in sctp_sendmsg sctp_wait_for_sndbuf could schedule out without
holding sock sk. It means the current asoc can be freed elsewhere,
like when receiving an abort packet.

If the asoc is just created in sctp_sendmsg and sctp_wait_for_sndbuf
returns err, the asoc will be freed again due to new_asoc is not nil.
An use-after-free issue would be triggered by this.

This patch is to fix it by setting new_asoc with nil if the asoc is
already dead when cpu schedules back, so that it will not be freed
again in sctp_sendmsg.

v1->v2:
  set new_asoc as nil in sctp_sendmsg instead of sctp_wait_for_sndbuf.

Suggested-by: default avatarNeil Horman <nhorman@tuxdriver.com>
Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6363b3f3

net/sctp/socket.c

+14 −3
Original line number Original line Diff line number Diff line
@@ -1971,9 +1971,15 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) 
	timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);

	timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);

	if (!sctp_wspace(asoc)) {

	if (!sctp_wspace(asoc)) {

		err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);

		err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);

		if (err)

		if (err) {

			if (err == -ESRCH) {

				/* asoc is already dead. */

				new_asoc = NULL;

				err = -EPIPE;

			}

			goto out_free;

			goto out_free;

		}

		}

	}





	/* If an address is passed with the sendto/sendmsg call, it is used

	/* If an address is passed with the sendto/sendmsg call, it is used

	 * to override the primary destination address in the TCP model, or

	 * to override the primary destination address in the TCP model, or
@@ -8006,10 +8012,11 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, 
	for (;;) {

	for (;;) {

		prepare_to_wait_exclusive(&asoc->wait, &wait,

		prepare_to_wait_exclusive(&asoc->wait, &wait,

					  TASK_INTERRUPTIBLE);

					  TASK_INTERRUPTIBLE);

		if (asoc->base.dead)

			goto do_dead;

		if (!*timeo_p)

		if (!*timeo_p)

			goto do_nonblock;

			goto do_nonblock;

		if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING ||

		if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING)

		    asoc->base.dead)

			goto do_error;

			goto do_error;

		if (signal_pending(current))

		if (signal_pending(current))

			goto do_interrupted;

			goto do_interrupted;
@@ -8034,6 +8041,10 @@ out: 




	return err;

	return err;





do_dead:

	err = -ESRCH;

	goto out;



do_error:

do_error:

	err = -EPIPE;

	err = -EPIPE;

	goto out;

	goto out;

CRA Git | Maintained and supported by SUSTech CRA and CCSE